Security Setting Import-Export

The security setting export-import feature offers an alternative to pre-deployment installer tuning and post deployment configuration techniques such as GPO. For some enterprises, it can simplify the migration of existing security settings through version upgrades and across multiple machines. Settings can only be exported from Acrobat, but settings can be imported by both Acrobat and Adobe Reader. Introduced with 9.0, the ability to import and export digital signature settings via an``.acrobatsecuritysettings`` file allows you to secure, migrate, backup, restore, and distribute settings. Files can also be placed on a server, and client machines can be configured to automatically download such settings at required intervals.

How it works

The user interface allows users to export settings to a secure file. The settings are represented as XML containing elements that describe details for each supported security component, including encryption, digital signatures, usage rights, trusted identities, and so on. The format provides capabilities for different levels of the security settings management. The XML is embedded in an empty PDF document. The PDF has an .acrobatsecuritysettings extension. On export, the file is certified with an invisible signature and optionally encrypted so that only authorized users can access it and verify its trustworthiness before installation. At import time, the certification signature status is displayed at the top of the Import Security Settings dialog box.

Note

Some settings such as PKCS#11 modules require manual installation and cannot automatically be moved.

Export to a File

Settings can only be exported from Acrobat.

1. Choose Preferences > Security > Security Settings > Export.
2. Check or uncheck the settings you would like to export.
3. Choose OK.

4. When the detailed Export Security Settings dialog appears, review the settings again.
5. If you would like to include or exclude any settings, highlight the setting and choose the Include/Exclude Setting button.
6. Choose Export.
7. Choose an encryption method. Encrypting the file ensures that the settings can’t be viewed by anyone other than the intended recipients.
8. Follow the dialog instructions which will vary with your choice of the document security method (password security or certificate security).
9. Choose OK.
10. You will be required to certify the file by signing it with a certification signature. When the certification workflow begins, choose OK.
11. Sign and save the file.

Import from a File

Settings can be imported by both Acrobat and Adobe Reader. To import security settings:

1. Open the Security Settings Console.
2. Browse to an .acrobatsecuritysettings file.
3. Choose Open.
4. acrobatsecuritysettings files must be certified and are therefore signed. You can verify the signer’s identity by choosing the Signature Properties in the Document Message Bar and reviewing the signer’s details.
5. Review the settings carefully. The settings in the imported file will overwrite your current settings. Be sure to verify you’re getting the correct settings and that they are coming from a trusted source.
6. Choose Import.
7. If the settings you imported included Digital IDs, you must log into each such ID to complete its installation. If there were Digital IDs then a dialog appears asking if you’d like to open the Security Settings Console and log in to the digital IDs you just imported. Choose Yes or No.

Note

For security reasons, acrobatsecuritysettings files do not carry the digital ID passwords. Before you can use any of the digital IDs you just imported, you must log in to each ID. You can do it now or later.

Manual Server Import Setup

If your organization distributes security settings periodically, you can set up Acrobat to regularly check for updates to these policies. Server-based security is set up by an administrator who provides the URL from which to get security updates. Once the application is configured, Acrobat will periodically poll the server (the default time is every three months) via http or https.

1. Choose Preferences > Security.
2. Check Load security settings from a server.
3. Enter the server address in the URL field.
4. Select a signing certificate. if any. The .acrobatsecurity file will be signed with a certified signature. In order to install the file, you must validate the signature.
5. Specify how often you want to check for security updates.
6. Select Ask Before Installing to be notified prior to installing new settings.
7. When the file opens, complete the import workflow.

Registry-Plist Configuration

As described in the Preference Reference, the following settings are available:

Keyname	Summary
{keyname}	{summary}